linux-kernel - [PATCH] kexec: Disable at runtime if the kernel enforces module signing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri,  9 Aug 2013 03:36:37 -0400
From:	Matthew Garrett <matthew.garrett@...ula.com>
To:	ebiederm@...ssion.com
Cc:	kexec@...ts.infradead.org, linux-kernel@...r.kernel.org,
	Matthew Garrett <matthew.garrett@...ula.com>
Subject: [PATCH] kexec: Disable at runtime if the kernel enforces module signing

kexec permits the loading and execution of arbitrary code in ring 0, which
is something that module signing enforcement is meant to prevent. It makes
sense to disable kexec in this situation.

Signed-off-by: Matthew Garrett <matthew.garrett@...ula.com>
---
 include/linux/module.h |  4 ++++
 kernel/kexec.c         | 10 ++++++++++
 kernel/module.c        |  4 ++--
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/include/linux/module.h b/include/linux/module.h
index 46f1ea0..2871ab2 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -29,6 +29,10 @@
 
 #define MODULE_NAME_LEN MAX_PARAM_PREFIX_LEN
 
+#ifdef CONFIG_MODULE_SIG
+extern bool sig_enforce;
+#endif
+
 struct modversion_info
 {
 	unsigned long crc;
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 59f7b55..297a268a 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -32,6 +32,7 @@
 #include <linux/vmalloc.h>
 #include <linux/swap.h>
 #include <linux/syscore_ops.h>
+#include <linux/module.h>
 
 #include <asm/page.h>
 #include <asm/uaccess.h>
@@ -1645,6 +1646,15 @@ int kernel_kexec(void)
 		goto Unlock;
 	}
 
+#ifdef CONFIG_MODULE_SIG
+	/*
+	 * Kexec makes it trivial to evade module signing, so forbid it when
+	 * the kernel requires signatures
+	 */
+	if (sig_enforce)
+		return -EPERM;
+#endif
+
 #ifdef CONFIG_KEXEC_JUMP
 	if (kexec_image->preserve_context) {
 		lock_system_sleep();
diff --git a/kernel/module.c b/kernel/module.c
index 2069158..58f6e21 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -109,9 +109,9 @@ struct list_head *kdb_modules = &modules; /* kdb needs the list of modules */
 
 #ifdef CONFIG_MODULE_SIG
 #ifdef CONFIG_MODULE_SIG_FORCE
-static bool sig_enforce = true;
+bool sig_enforce = true;
 #else
-static bool sig_enforce = false;
+bool sig_enforce = false;
 
 static int param_set_bool_enable_only(const char *val,
 				      const struct kernel_param *kp)
-- 
1.8.3.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/